ThreatFox: Remcos IOCs

Hunt Hypothesis

This hypothesis targets the presence of known Remcos Remote Access Trojan indicators, which adversaries deploy to establish persistent backdoors for remote control and data exfiltration. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints before the malware can be leveraged for lateral movement or credential theft, reducing the mean time to detection for this high-severity threat.

IOC Summary

Malware Family: Remcos Total IOCs: 3 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Remcos
let malicious_ips = dynamic(["45.67.139.138", "31.59.137.16"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.67.139.138", "31.59.137.16"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Remcos
let malicious_domains = dynamic(["u6ytrewqgrfewdmmmjhfjpooiuyhgghfdsaokjbn.duckdns.org"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Remcos

False Positive Guidance

• Remote Desktop Administration via RDP Client Configuration: Legitimate IT administrators often use third-party RDP clients (such as Microsoft Remote Desktop Manager, mRemoteNG, or Royal TS) to manage fleets of Windows servers. These tools frequently store connection profiles in XML or JSON files that include specific registry keys or file paths matching Remcos IOCs (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\RemoteDesktopServices\Sessions or specific .rdp file locations). To mitigate this, exclude processes originating from known administrative tool binaries (e.g., rdpmanager.exe, mremote.exe) or filter events where the parent process is a recognized RDP client application.
• Scheduled Task for Log Rotation or Cleanup: Enterprise environments often use scheduled tasks to rotate logs, clean up temporary files, or perform disk maintenance. A scheduled task named Remcos or containing IOCs in its XML definition (if the task was created by a script that inadvertently used a generic name or if the IOC matches a common path like C:\Temp\Remcos) could trigger the rule. Specifically, if the IOC targets a file path like C:\Users\Public\Remcos\, a legitimate backup or log archive job might place files there. Exclude scheduled tasks where the action command points to standard system utilities (e.g., powershell.exe, cmd.exe, robocopy.exe) or filter based on the task’s creator being a service account (e.g., DOMAIN\svc-backup) rather than an interactive user.
• Development or Testing Environments with Mock Data: In software development or QA environments, teams may create mock user profiles or test data that includes directories or registry keys named after known malware families for testing detection logic or application compatibility. For example, a developer might create a folder C:\Projects\Remcos_Test\ or set a registry key `HKLM\SOFTWARE\